forcepoint#110 set PaMs to somewhere safe to park

Change-Id: I4dbf27d67b74ff99583dad46a5448700f133c2f5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138371
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>

2 files changed, 7 insertions, 2 deletions

diff --git a/sw/qa/core/data/rtf/pass/forcepoint110.rtf b/sw/qa/core/data/rtf/pass/forcepoint110.rtf
new file mode 100644
index 000000000000..b7594ff6b622
--- /dev/null
+++ b/sw/qa/core/data/rtf/pass/forcepoint110.rtf
diff --git a/sw/source/core/unocore/unoframe.cxx b/sw/source/core/unocore/unoframe.cxx
index 1a42b81fb1f9..dacfa4114b3f 100644
--- a/sw/source/core/unocore/unoframe.cxx
+++ b/sw/source/core/unocore/unoframe.cxx
@@ -2825,8 +2825,13 @@ void SwXFrame::attachToRange(uno::Reference<text::XTextRange> const& xTextRange,
                 aFrameSet.Put( SwFormatAnchor( RndStdIds::FLY_AT_PAGE, 1 ));
             }
 
-            aPam.DeleteMark(); // mark position node will be deleted!
-            aIntPam.DeleteMark(); // mark position node will be deleted!
+            // park these no longer needed PaMs somewhere safe so MakeFlyAndMove
+            // can delete what it likes without any assert these are pointing to
+            // that content
+            aPam.DeleteMark();
+            aIntPam.DeleteMark();
+            *aPam.GetPoint() = *aIntPam.GetPoint() = SwPosition(pDoc->GetNodes());
+
             pFormat = pDoc->MakeFlyAndMove( *pCopySource, aFrameSet,
                            nullptr,
                            pParentFrameFormat );